Privacy and Security Solutions for Interoperable Health Information Exchange

Transcription

1 December 20, 2007 Privacy and Security Solutions for Interoperable Health Information Exchange Impact Analysis Prepared for Jodi Daniel, JD, MPH, Director Steven Posnack, MHS, MS, Program Analyst Office of Policy and Research Office of the National Coordinator 330 C Street SW Switzer Building, Room 4090 Washington, DC P. Jon White, MD, Director of Health IT Agency for Healthcare Research and Quality 540 Gaither Road Rockville, MD Prepared by Linda L. Dimitropoulos, PhD RTI International 230 W Monroe, Suite 2100 Chicago, IL Contract Number RTI Project Number

2

3 RTI Project Number Privacy and Security Solutions for Interoperable Health Information Exchange Impact Analysis December 20, 2007 Prepared for Jodi Daniel, JD, MPH, Director Steven Posnack, MHS, MS, Program Analyst Office of Policy and Research Office of the National Coordinator 330 C Street SW Switzer Building, Room 4090 Washington, DC P. Jon White, MD, Director of Health IT Agency for Healthcare Research and Quality 540 Gaither Road Rockville, MD Prepared by Linda L. Dimitropoulos, PhD RTI International 230 W Monroe, Suite 2100 Chicago, IL RTI International is a trade name of Research Triangle Institute.

4 Identifiable information in this report or presentation is protected by federal law, section 924(c) of the Public Health Service Act, 42 USC. 299c-3(c). Any confidential identifiable information in this report or presentation that is knowingly disclosed is disclosed solely for the purpose for which it was provided.

5 Contents Section Executive Summary Page ES-1 1. Introduction Background Methodology The Privacy and Security Solutions Project and the Evolving State and Nationwide Landscape of Health IT and Health Information Exchange Landscape Before the Project Evolution of the Landscape During the Project Impact Analysis Legislation Executive Orders Leadership and Governance Stakeholder Education and Knowledge Development and Sustainability of Health IT/HIE Efforts in the States Collaborative (Cross-State) Outcomes Collaborative Work Groups Consumer Education and Engagement Provider Education Standards Policy Adoption Harmonizing State Privacy Law Consent Options, Outcomes, and Best Practices Consent Data Elements Required for Data Transfer Interorganizational Agreements Other Cross-State Initiatives and Interstate Projects Overview of Individual States/Territories Introduction to the Individual State/Territory Overviews Alaska Arizona Arkansas Impact Analysis v

6 4.1.4 California Colorado Connecticut Florida Illinois Indiana Iowa Kansas Kentucky Louisiana Maine Massachusetts Michigan Minnesota Mississippi New Hampshire New Jersey New Mexico New York North Carolina Ohio Oklahoma Oregon Puerto Rico Rhode Island Utah Vermont Washington West Virginia Wisconsin Wyoming Impact in Nonparticipating States Conclusions References 6-1 Appendix A: Glossary of Acronyms A-1 vi Impact Analysis

7 Tables Number Page 2-1 State Legislative Activity in Health IT, Legislation Introduced and Passed State Legislative Activity in Health IT, Legislation Introduced But Not Passed State Legislative Activity in Health IT, Legislation Not Introduced to Date Health IT Related Executive Orders Issued by State Governors Impact Analysis vii

8

9 EXECUTIVE SUMMARY This Impact Analysis report is the seventh in a series of reports to be produced under RTI International s contract with the Office of the National Coordinator for Health Information Technology (ONC) and the Agency for Healthcare Research and Quality (AHRQ). During the past 18 months, participating state teams 1 have successfully completed an assessment of the variation among business practices, policies, and laws to gain a better understanding of the privacy and security landscape within their states to prepare them to develop a comprehensive plan to protect health information that is stored and exchanged electronically. The state teams also identified practices, policies, and laws that create barriers to electronic health information exchange and have worked to develop possible solutions to these barriers that both preserve and protect privacy and security and promote interoperable electronic health information exchange. The Privacy and Security Solutions project has provided the state teams with the leadership, methodology, and funding to engage and educate stakeholders within their states and build coalitions of stakeholders across diverse areas within the health care system. The Impact Analysis report provides an analysis of the many ways that the Privacy and Security Solutions project has impacted the landscape for electronic health information exchange both within and across the participating states. To date, the project has had the greatest impact on the following areas: legislation; executive orders; leadership and governance; stakeholder education and knowledge; and, development and sustainability of health information technology (health IT)/health information exchange efforts in the states. A separate section detailing the progress of the collaborative work groups and other crossstate initiatives and interstate projects is included. The report consists of 6 major sections: Introduction Impact Analysis Collaborative (Cross-State) Outcomes Overview of Individual States/Territories Conclusions References Background This report provides an analysis of the impact of the Privacy and Security Solutions project activities, both within and across the participating states. The primary emphasis of the 1 Throughout this report the 33 states and 1 territory are referred to as the state project teams or as the state teams. Impact Analysis ES-1

10 Privacy and Security Solutions for Interoperable Health Information Exchange impact analysis is necessarily state-specific: state project teams have identified outcomes and impacts that are specific to their states and their unique health information exchange environments. The report also discusses impacts achieved through participation in multiand cross-state activities. It primarily addresses the broader impacts of the project on privacy and security solutions within the states and, to a lesser degree, on larger health IT initiatives. Methodology To assess and analyze the impacts of the Privacy and Security Solutions project and related activities, it was necessary first to examine the states status at the start of the project. In early 2006, states and territories applying for funding to participate in Phase I of the Privacy and Security Solutions project were asked to provide an environmental scan characterizing the health IT initiatives and projects within their states and the scope of stakeholder involvement in these efforts. These environmental scan sections of the state project proposals served as the primary source of information on the states status at the onset of the project. These findings were then compared with the states progress in implementing solutions to address privacy and security issues in electronic health information exchange. Impacts realized during the project were identified from reviews of the states final implementation plans, and from participation in collaborative work groups. Additional reports from state project directors were used to verify and supplement this initial information. Landscape Before the Project When the Privacy and Security Solutions project began, participating states were at different stages of health information exchange development. In their project proposals, all states reported some type of existing health IT and health information exchange activity. These activities included independent, isolated health IT efforts by individual health care organizations (generally done to build or expand internal IT capabilities); implementation of 1 or more local multi-organizational health information exchange efforts, which were limited in scope and participation; and early planning of a statewide electronic health information exchange. Most of these efforts were funded by the organizations themselves or with seed or start-up monies from federal, state, or private foundation sources. Only a relatively small number of states reported a high level of maturity in their local efforts, such as the establishment of foundational components of a statewide initiative, early implementation of a statewide health information exchange effort, or an operating statewide health information exchange (HIE) program. Findings from the first and second surveys of local, regional, and state health information exchange activities conducted in 2004 and 2005 by the ehealth Initiative (ehealth Initiative, 2005) and from an independent evaluation of the evolution of state HIEs (Agency for Healthcare Research and Quality, 2006) confirm this initial assessment of the status of health information exchange development across the ES-2 Impact Analysis

11 Executive Summary nation. Both studies showed that more than 100 projects related to health information exchange existed in at least 35 states. In the remaining 15 states and territories, health information exchange projects were also likely under way but not identified because of their size, scope, or early planning stage. These studies reveal 2 important points about the early stage of health information exchange development (before the start of the Privacy and Security Solutions project): A relatively small number of states had a defined entity or program that was recognized as the state HIE effort (ie, both a defined state HIE effort and an identified independent entity or government agency that had taken the formal role of facilitating, coordinating, convening, or operating this state effort). No state anchor or multistakeholder body (whether a state committee, commission, board, or other) had been given responsibility for addressing health information privacy and security issues. Other important factors were evident in these early stages of development: The underlying state infrastructure for health IT and health information exchange was lacking. Few states had started statewide health information exchange planning efforts, including assessments of needs and capabilities (ie, surveying state providers to assess the level of penetration of foundational health information technologies, such as electronic health records (EHRs)) or development of a framework and road map for moving forward. Organization and governance for a state health information exchange effort were evolving. The key roles of state government as a participant, convener, and coordinator were emerging. Ensuring consumer participation in the process was a major challenge. Financial models for initial development and sustainable operations were being developed. Evolution of the Landscape During the Project The period between 2005 and 2007 was instrumental in moving the nation closer to a transformation in health IT and health information exchange. This process has been fueled by the significant investment and national leadership that the federal government provided for these issues through the efforts of the Office of the National Coordinator for Health Information Technology, the Agency for Healthcare Research and Quality, the Centers for Medicare & Medicaid Services, the Health Resources and Services Administration, the National Library of Medicine, the Centers for Disease Control and Prevention, the Substance Abuse and Mental Health Services Administration, the Department of Veterans Affairs, the Department of Defense, and many others. Impact Analysis ES-3

12 Privacy and Security Solutions for Interoperable Health Information Exchange During this period state policy makers (both state governors and legislatures) and the private sector have become highly interested in health IT and health information exchange issues and have recognized their significance. Over the past 2 years alone, more than 300 state legislative initiatives related to health IT and health information exchange have been introduced across the country. A number of state governors have issued executive orders identifying, assigning, or creating state bodies to guide the development of state health information exchange efforts. Findings from the third annual survey of health information exchanges conducted by ehealth Initiative (2006), the State Level Health Information Exchange project implemented by the Foundation of Research and Education of the American Health Information Management Association (FORE/AHIMA; 2007a,b), and the National Governors Association (NGA) State Alliance for e-health (NGA, 2007) 2 provide evidence of this impressive body of state policy making initiatives in support of local, regional, and state health IT and health information exchange. As documented by the National Conference of State Legislatures (NCSL s) Health Information Technology Champions (HITCh) initiative (NCSL, 2007), 3 legislation adopted and enacted in 2007 alone covered 5 major areas: increasing state funding to support the adoption of health information technologies (such as EHRs by state providers); creating and supporting local and regional health information organizations and providing core funding for the implementation of a statewide HIE; establishing governance structures to guide and coordinate the planning and development of a statewide HIE; addressing privacy and security issues, such as consent approaches, and creating a state privacy and security board; and supporting the participation of public health and Medicaid in state HIE pilot projects and initiatives. From 2004 (before the Privacy and Security Solutions project) to 2007, state partners made significant progress in implementing statewide health information exchange. According to reports from state project directors (supplied for the Assessment of Variation and Analysis of Solutions Report), a shift has been noted from the stages of early planning to more mature efforts establishing foundational components, early implementation, and establishing an operating statewide implementation. 2 Information on the NGA State Alliance for e-health is available at the website (NGA, 2007). 3 NCSL s HITCh initiative is a partnership aimed at strengthening the capacity of state legislators to respond to issues related to the use of technology to improve access, quality, and effectiveness in health care. HITCh maintains a list of all introduced and enacted health IT and health information exchange state legislation. More information is available at the website (NCSL, 2007). ES-4 Impact Analysis

13 Executive Summary Impact Analysis The impact of the Privacy and Security Solutions project can be observed in 5 major domains: legislation, executive orders, leadership and governance, stakeholder education and knowledge, and support for health information exchanges. The information analyzed in this section was drawn from the individual state reports of progress that occurred from the beginning of the project through the conclusion of Phase II (see Section 1.2 for additional discussion of methodology). The process of the Privacy and Security Solutions project played a critical role in state teams success. In identifying variations, developing solutions, and implementing foundational privacy and security solutions, the teams were able to build awareness of health IT and health information exchange issues across their respective states and generate momentum toward interoperability. This section addresses key areas in which states have made substantial progress as a result of the project. Legislation States are in different stages of progress regarding legislation: some states have already passed new legislation, others have bills under active consideration, and still others are drafting legislation to be introduced in future legislative sessions in 2008 or The Third Annual Survey of Health Information Exchange Activities at the State, Regional and Local Levels, conducted by the ehealth Initiative and summarized in the report Improving the Quality of Healthcare Through Health Information Exchange (ehealth Initiative, 2006), and a summary from the National Council of State Legislatures provides an extensive overview of legislation passed between 2005 and This includes many bills that fall under the broad umbrella of health IT. With respect to legislation, this section of the report considers a narrower set of bills, namely those where the Privacy and Security Solutions project participants directly contributed to the legislation s drafting or passage. Discussions with project directors in each of the states participating in the Privacy and Security Solutions project led to identification of additional project-related legislative activities in 11 states. The intent of state legislation was to update and align statutes with the electronic health information environment and address legal barriers to electronic exchange. States worked diligently to mitigate the risk of codifying existing variations in business practices related to health information exchange by involving multiple stakeholders and getting feedback from a broad audience before passage. The positive impact these legislative efforts have on electronic health information exchange and how well they reduce privacy and security variations in their application among organizations who engage in electronic health information exchange will be an important measure of success. Impact Analysis ES-5

14 Privacy and Security Solutions for Interoperable Health Information Exchange Executive Orders Executive orders issued by state governors are another indicator of the Privacy and Security Solutions project s impact. Some of the executive orders predate the project, and when this is the case, state teams often cited the executive order as an impetus for applying for funding under the Privacy and Security Solutions project. As a direct result of this project, executive orders have been issued in Kansas, Mississippi, and Ohio. Several states reported that executive orders are under consideration by their respective governors. The executive orders offer formal support for the project and help to sustain efforts towards interoperable exchange. Leadership and Governance As state teams moved through the process of identifying variations, creating solutions, and beginning implementation, many identified a need for specific privacy and security leaders to take ownership of the implementation process and oversee future steps. The Privacy and Security Solutions project was designed to support sustainable solutions for interoperable health information exchange for example, by having state teams work closely with stakeholders and by requiring teams to secure a letter of support from their governor. The project has built on the existing leadership at the state level, allowing states to identify champions and accelerate progress toward interoperable exchange. Before the launch of the Privacy and Security Solutions project, state-level leadership and support for health IT and health information exchange varied widely, with most states lacking well-defined, coordinated leadership. As a result of the Privacy and Security Solutions project, state teams generally reported the formation of 3 types of leadership structures: government-supported boards, commissions, or task forces (15 states); leadership structures of HIE entities (3 states); and convenor organizations (4 states). The leadership of HIEs and convenor organizations has continued, and state teams have built from the existing expertise and commitment, even though the work of the governmentsupported initiatives was often limited by time or task objectives. The Privacy and Security Solutions project has also proved significant in its reach. Many state teams reported much higher levels of interest from governors, legislators, and state agencies than existed before the project. This reported increase in interest is supported by the increased number of introduced bills and executive orders related to health IT and health information exchange that occurred during the contract span. State teams also received support in other ways, such as the endorsement of the Privacy and Security Solutions state project teams and the establishment of steering committees by their legislative and executive branches. ES-6 Impact Analysis

15 Executive Summary Stakeholder Education and Knowledge A key goal of the Privacy and Security Solutions project was for state teams to create a broad base of support among stakeholders in their states to develop consensus solutions and sustainability that would extend beyond the contract period. The Privacy and Security Solutions project provided state teams with the resources to engage a broader range of stakeholders than would have been possible otherwise. Similarly, it afforded states the resources to engage on a broader array of issues. One of the key developments in this area is the understanding that privacy and security are essential components of exchange. Similarly, state teams have also realized that the technology to support exchange exists, and that policies, workflow considerations, and broad stakeholder buy-in must be established for successful exchange. Using the resources and tools provided through participation in the project, state project teams were able to examine the business practices for the exchange of health information not only in direct patient care, but also within a broader context. The 18 specific scenarios that were developed and used in the examination of business practices covered the following areas: treatment; payment; regional health information organizations (RHIOs); research data use; law enforcement; prescription drug use/benefit; health care operations/marketing; bioterrorism; employee health; public health; and state government oversight. A broad representation of stakeholder groups ensured that the project s review of variations and legal drivers would be comprehensive, and that a coalition of support would form and be sustained within the states to ensure that solutions developed and implementation plans would be carried forward successfully. Development and Sustainability of Health IT/HIE Efforts in the States The Privacy and Security Solutions project has helped states establish a privacy and security foundation with which to develop new health IT efforts. Moreover, state teams have reported increased engagement of stakeholders in the development and continuation of health IT efforts. As the state teams develop privacy and security solutions and implement them, they decrease barriers for other health IT and health information exchange efforts. This work is supported by the progress of existing projects to higher levels of development, and has fostered the development of new HIEs. Collaborative (Cross-State) Outcomes Almost unanimously, states reported that working with 33 other states and territories on the Privacy and Security Solutions project proved extremely valuable in understanding their state-specific challenges for health IT and health information exchange within a larger nationwide framework. The relationships that the states have forged, or are planning to pursue, reflect a variety of cross-state interests. A number of states have established better communications with Impact Analysis ES-7

16 Privacy and Security Solutions for Interoperable Health Information Exchange states in their geographical area. Many states, however, have developed relationships that are based on shared interests, not on geographical proximity. Some states need to share health information with distant states because their citizens often travel between them for vacations or health care. Other states have formed relationships to share information about common approaches to health information exchange architecture, issues, or projects. Collaborative Work Groups To increase the focus on cross-state collaboration, RTI was tasked with coordinating and overseeing the formulation of multistate, collaborative work groups during the extension period (June through December 2007) of the Privacy and Security Solutions project. Seven collaborative work groups have been focused on the following areas: consumer education and engagement provider education standards policy adoption harmonizing state privacy law consent options, outcomes, and best practices consent data elements required for data transfer interorganizational agreements Other Cross-State Initiatives and Interstate Projects In addition to the formal multistate collaborative groups formed under the Privacy and Security Solutions project, a number of states have reported laying foundations for or undertaking cross-state projects as part of the Privacy and Security Solutions project work. Some of these cross-state interactions resulted from networking opportunities provided by the project. Many states were able to point to distinct instances in which discussions with other states served as a significant resource informing their own projects. The potential for multistate and cross-collaborative work between the states is exceptionally strong, especially given the foundation that has been provided by the Privacy and Security Solutions project. Overview of Individual States/Territories Section 4 in this report summarizes the impact of the Privacy and Security Solutions project on the individual states participating in the project. Participating states are presented in alphabetical order. Each state s report includes 3 sections. The first section, Health IT/HIE Privacy and Security Landscape Before the Privacy and Security Solutions Project, describes the status of electronic health information exchange that existed before the project began. These descriptions have been drawn primarily from the proposals submitted by each state to be part of the project. The intent of this section is to provide the context for ES-8 Impact Analysis

17 Executive Summary understanding the impact of the project and describe the particular challenges faced in each state related to factors such as geography, population, and the health care delivery system. The second section, Current Health IT/HIE Landscape, captures changes that have occurred since those proposals were submitted, drawn from project reports on activities in each state, review of websites and other available material, and verified in discussions with key project staff in each state. The section describes progress made toward exchanging health information, such as the development of RHIOs or similar entities, or efforts to expand the exchange of health information. The third section for each state, Current Privacy and Security Landscape, focuses on privacy and security impacts within each state and also draws primarily from project reports and discussions with key project staff. This section is intended to provide detail about the heightened awareness of privacy and security issues in each state and the actions state teams have taken as a result of their participation in the Privacy and Security Solutions project. Conclusions This report provides a comprehensive review of the work conducted under the Privacy and Security Solutions project. It is clear that the 34 state teams have made substantial progress toward the reaching the goals stated at the outset of the project, which include: Assess variations in organization-level business policies and state laws that affect health information exchange; Identify and propose practical solutions, while preserving the privacy and security requirements in applicable federal and state laws, and; Develop detailed plans to implement solutions. This report describes the progress that state teams have made during the past 18 months toward meeting these goals. The teams have identified the sources of variation that must be reduced to arrive at a common set of policies that will permit private and secure nationwide health information exchange. They have worked to educate and engage the stakeholders within their individual states, laying the groundwork for an enduring statewide constituency through which they can work to achieve consensus on the implementation of solutions. The state teams now have an infrastructure in place that positions them to work toward harmonizing privacy practices, policies, and laws both within their individual states and across states. They are also leaving behind in states and communities a knowledge base about privacy and security issues in electronic health information exchange that endures to inform future health information exchange activities. The next steps for the state teams include accelerating the implementation of solutions by working in multistate collaboratives, developing dissemination pathways to achieve widespread adoption, and coordinating with the other national initiatives. Impact Analysis ES-9

18

19 1. INTRODUCTION 1.1 Background This Impact Analysis Report is the seventh in a series of reports to be produced under RTI International s contract with the Office of the National Coordinator for Health Information Technology (ONC) and the Agency for Healthcare Research and Quality (AHRQ). During the past 18 months, participating state teams 4 have successfully completed an assessment of the variation among business practices, policies, and laws to gain a better understanding of the privacy and security landscape within their states to prepare them to develop a comprehensive plan to protect health information that is stored and exchanged electronically. The state teams also identified practices, policies, and laws that create barriers to electronic health information exchange and have worked to develop possible solutions to these barriers that both preserve and protect privacy and security and promote interoperable electronic health information exchange. The Privacy and Security Solutions project has provided the state teams with the leadership, methodology, and funding to engage and educate stakeholders within their states and build coalitions of stakeholders across diverse areas within the health care system. This report provides an analysis of the impact of the Privacy and Security Solutions project activities, both within and across the participating states. The primary emphasis of the impact analysis is necessarily state-specific: state project teams have identified outcomes and impacts that are specific to their states and their unique health information exchange environments. The report also discusses impacts achieved through participation in multiand cross-state activities. It primarily addresses the broader impacts of the project on privacy and security solutions within the states and, to a lesser degree, on larger health information technology (health IT) initiatives. State teams have found a wide range of project impacts within their states. Both the nature and the extent of these impacts are related to the states prior levels of health IT development. Some states that were further along in their health IT implementations were able to develop and adopt privacy and security policies that were then adopted by the HIEs and regional health information organizations in their states. Others, just beginning discussions related to interoperable health information exchange, were able to bring a diverse group of stakeholders together and begin to address the identified barriers. Several states were able to enact legislation necessary to update their state statutes from a paperbased environment to one conducive to interoperable health information exchange in the electronic environment. 4 Throughout this report the 33 states and 1 territory are referred to as the state project teams or as the state teams. Impact Analysis 1-1

20 Privacy and Security Solutions for Interoperable Health Information Exchange Section 2 of this report addresses 5 specific areas of impact: legislation, executive orders, leadership and governance, stakeholder education and knowledge, and development and sustainability of health IT and health information exchange efforts in the states. Section 3 discusses cross-state initiatives and multistate collaborative work groups, along with their resulting impacts. Section 4 provides individual state summaries, focusing on impacts that have been realized since the Privacy and Security Solutions project began. Finally, Section 5 summarizes results and provides conclusions. 1.2 Methodology To assess and analyze the impacts of the Privacy and Security Solutions project and related activities, it was necessary first to examine the states status at the start of the project. In early 2006, states and territories applying for funding to participate in Phase I of the Privacy and Security Solutions project were asked to provide an environmental scan characterizing the health IT initiatives and projects within their states and the scope of stakeholder involvement in these efforts. These environmental scan sections of the state project proposals served as the primary source of information on the states status at the onset of the project. These findings were then compared with the states progress in implementing solutions to address privacy and security in electronic health information exchange. Impacts realized during the project were identified from reviews of the states final implementation plans, and from participation in collaborative work groups. Additional reports from state project directors were used to verify and supplement this initial information. 1.3 The Privacy and Security Solutions Project and the Evolving State and Nationwide Landscape of Health IT and Health Information Exchange Landscape Before the Project When the Privacy and Security Solutions project began, participating states were at different stages of health information exchange development. In their project proposals, all states reported some type of existing health IT and health information exchange activity. These activities included independent, isolated health IT efforts by individual health care organizations (generally done to build or expand internal IT capabilities); implementation of 1 or more local multi-organizational health information exchange efforts, which were limited in scope and participation; and early planning of a statewide electronic health information exchange. Most of these efforts were funded by the organizations themselves or with seed or start-up monies from federal, state, or private foundation sources. Only a relatively small number of states reported a high level of maturity in their local efforts, such as the establishment of foundational components of a statewide initiative, early implementation of a statewide health information exchange effort, or an operating statewide HIE program. Findings from the first and second surveys of local, regional, and state health information exchange activities conducted in 2004 and 2005 by the ehealth Initiative (ehealth Initiative, 1-2 Impact Analysis

21 Section 1 Introduction 2005) and from an independent evaluation of the evolution of state HIEs (Agency for Healthcare Research and Quality, 2006) confirm this initial assessment of the status of health information exchange development across the nation. Both studies showed that more than 100 projects related to health information exchange existed in at least 35 states. In the remaining 15 states and territories, health information exchange projects were also likely under way but not identified because of their size, scope, or early planning stage. These studies reveal 2 important points about the early stage of health information exchange development (before the start of the Privacy and Security Solutions project): A relatively small number of states had a defined entity or program that was recognized as the state HIE effort (ie, both a defined state HIE effort and an identified independent entity or government agency that had taken the formal role of facilitating, coordinating, convening, or operating this state effort). No state anchor or multistakeholder body (whether a state committee, commission, board, or other) had been given responsibility for addressing health information privacy and security issues. Other important factors were evident in these early stages of development: The underlying state infrastructure for health IT and health information exchange was lacking. Few states had started statewide health information exchange planning efforts, including assessments of needs and capabilities (ie, surveying state providers to assess the level of penetration of foundational health information technologies, such as electronic health records (EHRs)) or development of a framework and road map for moving forward. Organization and governance for a state health information exchange effort were evolving. The key roles of state government as a participant, convener, and coordinator were emerging. Ensuring consumer participation in the process was a major challenge. Financial models for initial development and sustainable operations were being developed Evolution of the Landscape During the Project The period between 2005 and 2007 was instrumental in moving the nation closer to a transformation in health IT and health information exchange. This process has been fueled by the significant investment and national leadership that the federal government provided for these issues through the efforts of the Office of the National Coordinator for Health Information Technology, the Agency for Healthcare Research and Quality, the Centers for Medicare & Medicaid Services, the Health Resources and Services Administration, the National Library of Medicine, the Centers for Disease Control and Prevention, the Substance Impact Analysis 1-3

22 Privacy and Security Solutions for Interoperable Health Information Exchange Abuse and Mental Health Services Administration, the Department of Veterans Affairs, the Department of Defense, and many others. During this period state policy makers (both state governors and legislatures) and the private sector have become highly interested in health IT and health information exchange issues and have recognized their significance. Over the past 2 years alone, more than 300 state legislative initiatives related to health IT and health information exchange have been introduced across the country. A number of state governors have issued executive orders identifying, assigning, or creating state bodies to guide the development of state health information exchange efforts. Findings from the third annual survey of health information exchanges conducted by ehealth Initiative (2006), the State Level Health Information Exchange project implemented by the Foundation of Research and Education of the American Health Information Management Association (FORE/AHIMA; 2007a,b), and the National Governors Association (NGA) State Alliance for e-health (NGA, 2007) 5 provide evidence to this impressive body of state policymaking initiatives in support of local, regional, and state health IT and health information exchange. As documented by the National Conference of State Legislatures (NCSL s) Health Information Technology Champions (HITCh) initiative (NCSL, 2007), 6 legislation adopted and enacted in 2007 alone covered 5 major areas: increasing state funding to support the adoption of health information technologies (such as EHRs by state providers); creating and supporting local and regional health information organizations and providing core funding for the implementation of a statewide HIE; establishing governance structures to guide and coordinate the planning and development of a statewide HIE; addressing privacy and security issues, such as consent approaches, and creating a state privacy and security board; and supporting the participation of public health and Medicaid in state HIE pilot projects and initiatives. From 2004 (before the Privacy and Security Solutions project) to 2007, state partners made significant progress in implementing statewide health information exchange. According to reports from state project directors (supplied for the Assessment of Variation and Analysis of Solutions Report), a shift has been noted from the stages of early planning to more mature efforts establishing foundational components, early implementation, and establishing an operating statewide implementation. 5 Information on the NGA State Alliance for e-health is available at the website (NGA, 2007). 6 NCSL s HITCh initiative is a partnership aimed at strengthening the capacity of state legislators to respond to issues related to the use of technology to improve access, quality, and effectiveness in health care. HITCh maintains a list of all introduced and enacted health IT and health information exchange state legislation. More information is available at the website (NCSL, 2007). 1-4 Impact Analysis

23 2. IMPACT ANALYSIS Section 2 describes the impact of the Privacy and Security Solutions project in 5 major domains: legislation, executive orders, leadership and governance, stakeholder education and knowledge, and support for health information exchanges (HIEs). The initiatives resulting from this project have brought about changes in business practices, policies, and state law; educational efforts aimed at providers and consumers; and several other approaches to reduce privacy and security variations related to the exchange of health information. The analysis in this section was drawn from the individual state reports of progress that occurred from the beginning of the project through the conclusion of Phase II (see Section 1.2 for additional discussion of methodology). The process of the Privacy and Security Solutions project played a critical role in state teams success. In identifying variations, developing solutions, and implementing foundational privacy and security solutions, the teams were able to build awareness of health information technology (health IT) and health information exchange issues across their respective states and generate momentum toward interoperability. As a result of the project, states have made substantial progress in the following key areas. 2.1 Legislation States are in different stages when it comes to legislation: some states have already passed new legislation, others have bills under active consideration, and still others are drafting legislation to be introduced in future legislative sessions in 2008 or In many states these activities preceded the project implementation and served, in part, to motivate participation in the project. In other states, such as Michigan and Minnesota, the work of the state project teams contributed to legislation enacted during the project. In addition, a number of states, including Rhode Island and New Hampshire, plan to introduce legislation in the upcoming session. The Third Annual Survey of Health Information Exchange Activities at the State, Regional and Local Levels, conducted by the ehealth Initiative and summarized in the report Improving the Quality of Healthcare Through Health Information Exchange (ehealth Initiative, 2006), and a summary from the National Council of State Legislatures (NCSL) provides an extensive overview of legislation passed between 2005 and The ehealth Initiative survey was fielded in May 2006, partway through the Privacy and Security Solutions project schedule. Survey respondents included health information exchange initiatives in 49 states, the District of Columbia, and Puerto Rico. The report documents 121 health IT related bills introduced in 38 states since 2005, with 36 bills passed and signed into law in 24 states (ehealth Initiative, 2006, pp. 9 10). The NCSL Health Information Technology Champions group states that by 2007 more than 250 health IT related bills Impact Analysis 2-1

24 Privacy and Security Solutions for Interoperable Health Information Exchange were introduced, with 59 passed in 34 states, plus the District of Columbia. Tables 2-1 through 2-3 summarize this activity. The information contained in these tables is current as of December 14, 2007, and is based on the sources listed. There may be some pieces of legislation missing based on when the ehealth Initiative and NCSL conducted their surveys. Table 2-1. State Legislative Activity in Health IT, Legislation Introduced and Passed Alabama Act , AL HJR 176 Enacted 04/16/ Establishes the Health Information Technology Partnership. Arizona a Chapter 255, AZ H 2781 Enacted 06/25/ Appropriates funds for electronic medical records. Arkansas a Act 1283, AR H 1354 Enacted 04/05/ Includes funding for the Health Department Technology Fund and for Information Technology Initiative activities of the Department of Health. California a CA SB 1039 Enacted 10/11/ Makes technical and conforming changes to the Public Health Act of Establishes new functions and responsibilities for the State Department of Public Health and the State Department of Health Care Services. Connecticut a House Bill No Enacted 06/26/2007 Implements the provisions of the budget concerning human services and public health. Senate Bill No Enacted 07/10/2007 Concerns the HealthFirst Connecticut and Healthy Kids initiatives. Colorado a Chapter 282, CO S 196 Enacted 05/24/ Creates the health IT advisory committee to develop a long-range plan for health care information technology. Chapter 319, CO H 1346 Enacted 05/29/ Allows for increased fees to cover use and maintenance of electronic health records to contractors within the Medical Assistance Program. Chapter 296, CO S 74 Enacted 05/25/ Creates the emergency access to health information demonstration program. Delaware DE S 155 Enacted 07/01/ Appropriates funds for the Delaware Health Information Network. District of Columbia DC B 2 Enacted 01/16/ Includes appropriations for electronic health records system in community health centers. (continued) 2-2 Impact Analysis

25 Section 2 Impact Analysis Table 2-1. State Legislative Activity in Health IT, Legislation Introduced and Passed (continued) Florida a House Bill No Enacted 06/20/ Renaming the State Center for Health Statistics; revising criteria for collection and use of certain health-related data; providing responsibilities of the Agency for Health Care Administration; providing for agency consultation with the State Consumer Health Information and Policy Advisory Council for the dissemination of certain consumer information; requiring the Florida Center for Health Information and Policy Analysis to provide certain technical assistance services Senate Bill No Enacted 07/01/2006 An act relating to medical records; amending s , F.S.; providing definitions; requiring a health care practitioner s employer who is a records owner and a records custodian to comply with specified requirements for confidentiality and disclosure; amending s , F.S.; providing requirements for prescriptions of medicinal drugs by health care practitioners which are electronically generated or transmitted; creating s , F.S.; regulating electronic prescribing for medicinal drugs; providing restrictions for electronic prescribing software; providing definitions; authorizing electronic prescribing software to show information regarding a payor s formulary under certain circumstances; Georgia GA H 94 Enacted 04/19/2007 Provides funding to the Georgia Association for Primary Health Care to complete the statewide electronic medical records system to link the Federally Qualified Community Health Centers. Idaho ID H 159 Enacted 03/27/2007 Creates a Community Health Center Grant Fund with the intent of improving access to health care services through grants. Illinois a IL S 3866 Enacted 08/23/2007 Funds expenses of the Adoption Registry and Medical Information Exchange. Indiana a Public Law 111, IN S 551 Enacted 05/02/2007 Establishes the Health Informatics Corporation. Iowa a IA H 451 Enacted 04/20/ Creates a single point of entry long-term living resource systems team. The team will issue a report to the general assembly by December 1, 2008, that includes recommendations regarding the use of electronic health records. IA H 909 Enacted 05/29/ Makes appropriations procurement and installation for electronic medical records within a state facility. Kansas a KS H 2368 Enacted 04/23/ Appropriates funds to support ongoing health information exchange initiatives that include health information exchange infrastructure planning, privacy and security collaboration, the advanced identification card project and the community health record project and to support the inclusion of disease management, a strengthening of electronic prescribing and electronic medical records, and the development of pilot programs and compatibility with the private sector. (continued) Impact Analysis 2-3

26 Privacy and Security Solutions for Interoperable Health Information Exchange Table 2-1. State Legislative Activity in Health IT, Legislation Introduced and Passed (continued) Kentucky a SB 2 Enacted 03/08/2005 Calls for the development and implementation of a statewide Kentucky e-health Network, or Ke-HN. The goal of Ke-HN is to improve the quality and reduce the cost of health care for Kentuckians. Louisiana a Act 243, LA S 1 Enacted 07/06/2007 Authorizes the Department of Health and Hospitals to develop and implement a health care delivery system for Medicaid recipients and low-income uninsured citizens. Act 172, LA S 238 Enacted 06/27/2007 Establishes the Health Care Redesign Fund in the state treasury. Act 203, H 765 Enacted 06/27/2007 Payable out of the State General Fund (Direct) for implementation of Phase I of the statewide electronic medical records system for state public hospitals and medical centers. Maine a Chapter 72, ME H 548 Enacted 05/04/2007 Expands the definition of health care facility under the Maine Health and Higher Educational Facilities Authority Act. Maryland MD H 979 Enacted 04/24/2007 Establishes a health information exchange pilot project. Massachusetts a MA H 4141 Enacted 07/12/2007 Appropriates funds for fiscal year MA H 4160 Enacted 10/10/2007 Establishes an electronic health records task force. Michigan a Public Act 7, MI S 404 Enacted 05/07/2007 Appropriations for the Medical Services Administration for health IT initiatives. MI S1 Enacted 10/01/2007 Requests a federal waiver for incentives for Medicaid recipients. Minnesota a Chapter 147, MN H 1078 Enacted 05/25/2007 To develop a statewide plan, including uniform standards to be used for meeting the 2015 goal, of providing an interoperable system for sharing and synchronizing patient data across systems. Chapter 148, MN H 548 Enacted 05/25/2007 To establish an enterprise-wide pilot project to provide consumer-owned electronic personal health records to employees of Minnesota state colleges and universities and all participants in the state employee group insurance program. Chapter 144, MN H 1063 Enacted 05/30/2007 Appropriates funds for higher education if certain conditions are met for increased training of students on the use of electronic medical record technology. Missouri MO S 577 Enacted 07/02/2007 Among other things creates a Healthcare Technology Fund. MO H 11 Enacted 06/27/2007 Funds an electronic pilot project in 1 or more skilled nursing facilities in Greene County to study the cost effectiveness of electronic health records in long-term care and the financial benefit to Missouri HealthNet from the Nursing Facility Quality of Care Fund. (continued) 2-4 Impact Analysis